Widget not in any sidebars
It didn’t get the data through a hack, but reportedly through a Facebook app which gave a researcher user data — and also the data of their friends.
Most people forget that when they download an app or sign into a website with Facebook, they are giving those companies a look into their Facebook profile. Your profile can often include your email address and phone number as well as your work history and current location. And most people don’t realize that if you’re sharing that data with friends, then apps used by those friends can see that data as well!
Advertisers, Facebook-app developers, and Facebook ad-tech partners can’t see your name, your phone number, or your employer — Facebook encrypts and anonymizes all the data to protect your privacy. But it does sell that data in bulk to companies who want to target and track both you and people like you.